Personal data protection

Information obligation of the operator

pursuant to Articles 13 and 14 of Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “Regulation”)

Operator

Name: Integrovaná doprava Žilinského a Trenčianskeho kraja, s.r.o.

Registered office: Pri Rajčianke 2900/43, 010 01 Žilina

E-mail: gdpr@idzk.sk

The operator processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and related regulations of the Slovak Republic.

Ownership structure

The company’s partners are the following local government entities: Trenčín Self-Governing Region (TSK), Žilina Self-Governing Region (ŽSK), the City of Žilina and the City of Trenčín.

Responsible Person (DPO)

The operator will assess whether it is obliged to designate a responsible person according to Art. 37 GDPR. Until the time of designation of the DPO, please contact the operator at the e-mail address provided above.

DPO: “undetermined”

Processing purposes, legal bases, recipients and retention periods

Communication (email, contact form, phone call)

  • Purpose of processing: handling questions, suggestions and mutual communication
  • Legal basis: legitimate interest pursuant to Article 6(1) of the GDPR. 1 letter f) GDPR alebo plnenie zmluvy, ak je relevantné
  • Categories of personal data: identification and contact data, content of communication
  • Recipients: internal employees; website IT support provider (if involved)
  • Retention period: until further notice

Requests under the Act on Free Access to Information (Act No. 211/2000 Coll.)

  • Purpose of processing: registration and processing of applications, appeals and communication with the applicant
  • Legal basis: legal obligation or task in the public interest pursuant to Article 6(1) GDPR. 1 letter c) or e) GDPR
  • Categories of personal data: applicant data (name, address, contact details), content of the application, procedural steps
  • Recipients: superior obliged entity or appeal body (if relevant); public authorities
  • Retention period: according to registration deadlines and specific legal regulations

Website operation (hosting and technical management)

  • Purpose of processing: ensuring the availability, functionality and security of the website
  • Legal basis: legitimate interest pursuant to Article 6(1) of the GDPR. 1 letter f) GDPR
  • Categories of personal data: technical data, system logs, IP address to the necessary extent
  • Recipients: Websupport s.r.o. (hosting); M KREO, s.r.o. (web administrator)
  • Retention period: logs are kept according to security needs

Google Analytics (GA4) – analytical measurement

  • Purpose of processing: statistical evaluation of traffic and improvement of the website
  • Legal basis: consent of the data subject (opt-in), analytical cookies are activated only after consent is granted
  • Categories of personal data: cookies and online identifiers, device and browser data, web interaction data
  • Recipients: Google (Google Analytics); internal administrators of analytical tools
  • Retention period: according to Google Analytics settings

Google Maps (embedded map)

  • Purpose of processing: display of location and navigation to the headquarters or contact points
  • Legal basis: consent (recommended “click-to-load” or opt-in solution for external content)
  • Categories of personal data: technical data when loading the map (e.g. IP address, identifiers), data about interaction with the map
  • Recipients: Google (Google Maps)
  • Retention period: according to Google settings; the website operator generally does not store map data separately

Cookies and consent management

We use essential cookies on the website for the website to function. Analytical cookies (Google Analytics) and external content (Google Maps) are only activated after you have given your consent in the cookie bar / cookie settings. You can withdraw your consent at any time by changing your cookie settings (link in the footer of the website).

Transfers to third countries (outside the EU/EEA)

Google services may also transfer personal data outside the EU/EEA (e.g. the USA). The operator will ensure that transfers are carried out in accordance with the GDPR (e.g. through standard contractual clauses and supplementary measures, if necessary).

Rights of data subjects

  • right to access personal data
  • right to correction
  • right to erasure (under GDPR conditions)
  • the right to restrict processing
  • the right to object to processing based on legitimate interest
  • right to portability (if applicable)
  • the right to withdraw consent at any time (if it is the legal basis)
  • the right to file a complaint with the supervisory authority (ÚOOÚ SR)

How to exercise your rights and file a complaint

You can exercise your rights by email or in writing to the address of the controller’s registered office. If you believe that the processing violates the GDPR, you have the right to file a complaint with the Office for Personal Data Protection of the Slovak Republic (ÚOOÚ SR).